CVE-2015-8370 Integer overflow in n/a

High 7.4 Published 16 Dec 2015 Updated 21 Oct 2024

Physically proximate attackers can bypass authentication, read sensitive data, or corrupt disks via integer underflows in GRUB2 password input handling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2015-8370?

CVE-2015-8370 is a high-severity vulnerability in Fedoraproject Fedora, published on 16 Dec 2015. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service (disk corruption) via backspace characters in the (1) grub_username_get function in grub-core/normal/auth.c or the (2) grub_password_get function in lib/crypto.c, which trigger an "Off-by-two" or "Out of bounds overwrite" memory error.

Weakness: CWE-264, CWE-191

Which versions are affected by CVE-2015-8370?

It affects 2 products.

Linux distribution packages (34)

`grub2` Red Hat:enterprise_linux:7::client	All versions	`1:2.02-0.33.el7_2`
`grub2-debuginfo` Red Hat:enterprise_linux:7::client	All versions	`1:2.02-0.33.el7_2`
`grub2-efi` Red Hat:enterprise_linux:7::client	All versions	`1:2.02-0.33.el7_2`
`grub2-efi-modules` Red Hat:enterprise_linux:7::client	All versions	`1:2.02-0.33.el7_2`
`grub2-tools` Red Hat:enterprise_linux:7::client	All versions	`1:2.02-0.33.el7_2`
`grub2` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.02-0.33.el7_2`
`grub2-debuginfo` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.02-0.33.el7_2`
`grub2-efi` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.02-0.33.el7_2`
`grub2-efi-modules` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.02-0.33.el7_2`
`grub2-tools` Red Hat:enterprise_linux:7::computenode	All versions	`1:2.02-0.33.el7_2`
`grub2` Red Hat:enterprise_linux:7::server	All versions	`1:2.02-0.33.el7_2`
`grub2-debuginfo` Red Hat:enterprise_linux:7::server	All versions	`1:2.02-0.33.el7_2`
`grub2-efi` Red Hat:enterprise_linux:7::server	All versions	`1:2.02-0.33.el7_2`
`grub2-efi-modules` Red Hat:enterprise_linux:7::server	All versions	`1:2.02-0.33.el7_2`
`grub2-tools` Red Hat:enterprise_linux:7::server	All versions	`1:2.02-0.33.el7_2`
`grub2` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.02-0.33.el7_2`
`grub2-debuginfo` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.02-0.33.el7_2`
`grub2-efi` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.02-0.33.el7_2`
`grub2-efi-modules` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.02-0.33.el7_2`
`grub2-tools` Red Hat:enterprise_linux:7::workstation	All versions	`1:2.02-0.33.el7_2`
`grub2` SUSE:Linux Enterprise Desktop 11 SP3	All versions	`2.00-0.49.2`
`grub2` SUSE:Linux Enterprise Desktop 11 SP4	All versions	`2.00-0.54.2`
`grub2` SUSE:Linux Enterprise Desktop 12	All versions	`2.02~beta2-56.9.4`
`grub2` SUSE:Linux Enterprise Desktop 12 SP1	All versions	`2.02~beta2-73.3`
`grub2` SUSE:Linux Enterprise Server 11 SP3	All versions	`2.00-0.49.2`
`grub2` SUSE:Linux Enterprise Server 11 SP3-TERADATA	All versions	`2.00-0.49.2`
`grub2` SUSE:Linux Enterprise Server 11 SP4	All versions	`2.00-0.54.2`
`grub2` SUSE:Linux Enterprise Server 12	All versions	`2.02~beta2-56.9.4`
`grub2` SUSE:Linux Enterprise Server 12 SP1	All versions	`2.02~beta2-73.3`
`grub2` SUSE:Linux Enterprise Server for SAP Applications 11 SP3	All versions	`2.00-0.49.2`
`grub2` SUSE:Linux Enterprise Server for SAP Applications 11 SP4	All versions	`2.00-0.54.2`
`grub2` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`2.02~beta2-56.9.4`
`grub2` SUSE:Linux Enterprise Server for SAP Applications 12 SP1	All versions	`2.02~beta2-73.3`
`grub2` openSUSE:Tumbleweed	All versions	`2.02~beta3-15.1`

Products include Fedoraproject Fedora, Gnu Grub2.

How do I fix CVE-2015-8370?

Apply the vendor's patch.

Is CVE-2015-8370 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-8370 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-8370, DLA-368-1, DSA-3421-1, GHSA-jjvg-65v4-v3cq, MGASA-2015-0480, RHSA-2015:2623 and 7 more.